feat: documentation site

Docusaurus 3 docs-only site at docsite/, served statically by nginx under
/docs on the marketing host. Covers getting started (self-hosted install
through first server and first licence), the control plane, Vantage HQ,
a reference section and operations.

Wired into docker-compose.site.yml as docsite (3005:80) and into the
image build workflow, rebuilding on its own directory only. Never added
to the self-hosted compose file.

docs/vantage/settings.md

@@ -0,0 +1,113 @@
+---
+id: settings
+title: Settings
+sidebar_label: Settings
+---
+
+One page, three groups: **Access**, **Monitoring** and **Integrations**. Plus
+the licence, which has its own page.
+
+Settings require the `owner` or `admin` role.
+
+:::info Where instance settings went
+Members and single sign-on used to live at `/settings/instance`. They are now
+the Access group at the top of this page — splitting "who can sign in" from "how
+this instance behaves" produced two half-pages and a nav entry nobody could
+distinguish from Settings. The old path still redirects.
+:::
+
+## Access
+
+### Members
+
+Add, remove and re-role the people who can sign in.
+
+| Role | Can |
+| --- | --- |
+| `owner` | Everything |
+| `admin` | Everything except owner-only settings |
+| `member` | Servers, keys, workflows, monitors, secrets, console |
+
+Local members authenticate with email and a bcrypt-hashed password.
+
+#### Members managed by Vantage HQ
+
+On a cloud instance, people granted access from the HQ portal appear here as
+read-only rows with a link to the portal.
+
+:::warning HQ-managed users cannot be edited locally
+Changing the role of, or deleting, an `hq`-sourced user is refused with `409`.
+HQ owns their role, their password and whether they exist at all — a local
+change would be overwritten by the next sync and would leave two writers for one
+password hash. Manage them from [People and roles](../hq/people-and-roles.md).
+:::
+
+### Single sign-on (OIDC)
+
+Configured per organisation:
+
+| Field | |
+| --- | --- |
+| Issuer | Your provider's issuer URL |
+| Client ID | |
+| Client secret | Stored AES-256-GCM encrypted |
+
+Sign-in then goes `/auth/oidc/start` → your provider → `/auth/oidc/callback`.
+
+Local and OIDC users coexist. Keep at least one local owner: if the provider is
+misconfigured or unreachable, a local account is the way back in.
+
+## Monitoring
+
+- **Alert defaults** for monitors.
+- **Notification channels** — their own page. See
+  [Notification channels](./notification-channels.md).
+
+## Integrations
+
+### Workflow log retention
+
+How long run logs are kept.
+
+| Value | Meaning |
+| --- | --- |
+| unset | 30 days |
+| a number | that many days |
+| `0` | forever |
+
+### ESO read token
+
+The bearer token External Secrets Operator uses to read secret groups. Shown
+once, stored as a SHA-256 hash, rotatable. See
+[Secrets](./secrets.md#kubernetes-external-secrets-operator).
+
+## Licence
+
+`/settings/license` shows the deployment, tier, server allowance, enabled
+features and expiry.
+
+On **self-hosted**, paste a licence here. This works even while the current
+licence is expired — that is the way out of degraded mode.
+
+On **cloud**, there is no paste form. The endpoint answers `409 cloud_managed`,
+because a cloud licence is written by HQ directly. The page links to the portal
+instead.
+
+See [Licensing and entitlements](../hq/licensing-and-entitlements.md).
+
+## Sessions
+
+Sessions are an opaque token in the `km_session` cookie, held in Redis with a
+24-hour TTL. There is no per-session management UI; restarting Redis signs
+everyone out and affects nothing else.
+
+## Host and organisation guard
+
+On a multi-tenant deployment, a request to `<slug>.vantage.<tld>` resolves the
+organisation from the slug and rejects a session belonging to a different one.
+The label it looks for comes from `APP_ROOT_LABEL`.
+
+:::warning A wrong `APP_ROOT_LABEL` disables the guard
+It does not fail loudly — it simply stops matching, and the host check stops
+protecting anything. If you serve the UI on a custom domain, set it to match.
+:::